Cyber Incident Responder – SIEM on ELK

About the role

Join the APAC Production Security team of a leading investment bank in Hong Kong as a Cyber Incident Responder. You will strengthen detection capabilities across the region, contribute to global use‑case development, and support 24/7 SOC operations.

Key responsibilities

• Lead technical activities for security use‑case definition, design, implementation and enrichment based on real‑world attack scenarios and the MITRE ATT&CK framework.
• Enhance SIEM (ELK) and SOAR capabilities to improve detection and response posture.
• Oversee detection capabilities for the 24/7 regional IT Production SOC handling security alerts.
• Respond to cyber and IT security incidents, assess severity, and drive mitigation actions.
• Identify recurring security issues, develop mitigation plans and recommend process improvements.
• Collaborate with global, regional and local stakeholders to ensure efficient detection and response processes.
• Partner with the APAC Business CSIRT to integrate security monitoring and incident handling.

Required profile

• Proven experience in security detection engineering, incident response and threat hunting.
• Strong understanding of real‑world threat landscape and ability to translate threats into actionable use‑cases.
• Ability to work autonomously on technical activities and lead cross‑functional initiatives.
• Excellent communication skills to partner with stakeholders across the organization.

Required skills

• ELK stack (Elasticsearch, Logstash, Kibana) for SIEM.
• SOAR platforms.
• MITRE ATT&CK framework.
• Threat hunting techniques.
• Security incident response processes.